Is CVE-2026-93017 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93017 being exploited in the wild.

How severe is CVE-2026-93017?

High severity, with a CVSS score of 7.7, published 8 October 2026.

Is there a fix for CVE-2026-93017?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93017 attacked?

It is attacked with local access or from the adjacent network, in a hosted service.

Am I affected by CVE-2026-93017?

Check whether you run Red Hat OpenShift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93017: Red Hat OpenShift insights-operator privilege escalation via unrestricted secret access

CVE-2026-93017 · Severity: high · CVSS 7.7 · Published 2026-10-08

The insights-operator component in Red Hat OpenShift has a configuration flaw that grants its service account read access to all secrets across every namespace in the cluster without proper restriction. An attacker who can create a pod using the operator's service account can access sensitive credentials and data stored in any cluster secret, potentially leading to unauthorized access to other systems and applications.

Technologies: Red Hat OpenShift. Vendors: Red Hat.

Quick answers

Is CVE-2026-93017 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93017 being exploited in the wild.
How severe is CVE-2026-93017?: High severity, with a CVSS score of 7.7, published 8 October 2026.
Which products and versions are affected?: Red Hat OpenShift <UNKNOWN>.
Is there a fix for CVE-2026-93017?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93017 attacked?: It is attacked with local access or from the adjacent network, in a hosted service.
Am I affected by CVE-2026-93017?: Check whether you run Red Hat OpenShift at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The insights-operator-gather ClusterRole defines overly permissive RBAC rules that allow the service account to get and list secrets from the core API group without namespace or resourceNames restrictions. By creating a pod with the gather service account mounted, an attacker gains read access to all secrets cluster-wide. This is a Kubernetes RBAC misconfiguration that enables privilege escalation and lateral movement within the cluster.

Affected products

Red Hat OpenShift <UNKNOWN>

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.